Web Application Security

OWASP

Symptom

A CSRF attack works because browser requests automatically include all cookies including session cookies. Therefore, if the user is authenticated to the site, the site cannot distinguish between legitimate authorized requests and forged authenticated requests.
Treatment
CSRF relies on cookies to work. If the service doesn't use cookies, CSRF protection can be turned off.
Resources

Pros
- Always work regardless of cookies settings
Cons
- not secure, as session ID is exposed in URL
- Only works for textual information

Key points
- Prevents XSS attacks by whitelisting the sources of content that are allowed to be loaded on a page
Implementations
- Spring Security
  - Security HTTP Response Headers :: Spring Security - Content Security Policy (CSP) (opens in a new tab)

Key points
- Enforce the use of HTTPS to protect against Man-in-the-Middle attacks
  
  e.g. Strict-Transport-Security: max-age=3600 will tell the browser that for the next hour (3600 seconds) it should not interact with the applications with insecure protocols.
  
  When a user tries to access an application secured by HSTS through HTTP, the browser will simply refuse to go ahead, automatically converting http:// URLs to https://.
- Preloading domains that enforce HSTS in the browser to ensure the first interaction is secure
  
  Browsers such as Chrome use a database to know if a website enforces HSTS. This database is called the HSTS Preload List. This is to ensure even the first interaction between the browser and the website is secure.
  - HSTS Preload List Submission (opens in a new tab)
Implementation
- Spring Security
  - Security HTTP Response Headers :: Spring Security - HTTP Strict Transport Security (HSTS) (opens in a new tab)
Resources

HTTP Strict Transport Security - OWASP Cheat Sheet Series (opens in a new tab)

Key points
- Deprecated, with all major browsers support removed due to complex implementation
- Declare that a website's HTTPS certificate should only be treated as valid if the public key is contained in a list specified over HTTP to prevent MITM attacks that use valid CA-issued certificates.
- Prevents Man-in-the-Middle attacks by ensuring the browser only accepts a specific certificate for a domain
- Ensure trust on the first interaction

Key points
- Replaced by Content-Security-Policy Level 2 frame-ancestors directive

Key points
- Defines a mechanism that allows developers to selectively enable and disable use of various browser features and APIs.
- Replaced by Permissions Policy and Document Policy